diff options
| author | Rob Crittenden <rcritten@redhat.com> | 2011-05-16 17:39:23 -0400 |
|---|---|---|
| committer | Rob Crittenden <rcritten@redhat.com> | 2011-05-27 13:51:37 -0400 |
| commit | 9cc0754b710500519c6f5fd41a0a0237a43e04b0 (patch) | |
| tree | 73534c646557c583290f0b9e070b7d1cf0e553d7 /ipalib/plugins/krbtpolicy.py | |
| parent | aa29a8a769c62b07cc4e6d82fc79846505cc9fa3 (diff) | |
| download | freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.tar.gz freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.tar.xz freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.zip | |
Add option to limit the attributes allowed in an entry.
Kerberos ticket policy can update policy in a user entry. This allowed
set/addattr to be used to modify attributes outside of the ticket policy
perview, also bypassing all validation/normalization. Likewise the
ticket policy was updatable by the user plugin bypassing all validation.
Add two new LDAPObject values to control this behavior:
limit_object_classes: only attributes in these are allowed
disallow_object_classes: attributes in these are disallowed
By default both of these lists are empty so are skipped.
ticket 744
Diffstat (limited to 'ipalib/plugins/krbtpolicy.py')
| -rw-r--r-- | ipalib/plugins/krbtpolicy.py | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/ipalib/plugins/krbtpolicy.py b/ipalib/plugins/krbtpolicy.py index c9d86ea65..4347f4146 100644 --- a/ipalib/plugins/krbtpolicy.py +++ b/ipalib/plugins/krbtpolicy.py @@ -74,6 +74,7 @@ class krbtpolicy(LDAPObject): container_dn = 'cn=%s,cn=kerberos' % api.env.realm object_name = 'kerberos ticket policy settings' default_attributes = ['krbmaxticketlife', 'krbmaxrenewableage'] + limit_object_classes = ['krbticketpolicyaux'] label=_('Kerberos Ticket Policy') |